multi: appease go 1.26 vet for non-const format + goroutine Fatalf
What the developer wrote
Authored by Olaoluwa Osuntokun
multi: appease go 1.26 vet for non-const format + goroutine Fatalf
In this commit, we fix two go vet errors that go 1.26 now treats as
hard failures during test compilation.
In btcjson/help.go, the final result row of a complex help description
was emitted via fmt.Fprintf with a non-constant format string (the
result text could contain '%' chars). Switch to fmt.Fprint, since
there are no format args here anyway.
In btcec/schnorr/musig2/musig2_test.go, the nonce-registration loop
ran inside a goroutine and called t.Fatalf on failure. Fatalf only
exits the calling goroutine, so the test goroutine would keep running
with stale state. Use t.Errorf + return so the failure is recorded
correctly and the goroutine exits cleanly.
What changed, and why it matters
This commit fixes two minor issues flagged by Go 1.26's vet tool. One is a test-only bug where a failing test inside a goroutine used the wrong error-and-exit call, which could leave the test running with bad state. The other is a non-security formatting bug in help text generation where percent signs in user-visible descriptions could be misinterpreted as format codes. Neither appears to be an exploitable security vulnerability.
No immediate security action required. Treat as routine code-quality/test-hygiene fix. Reviewers may optionally verify that no other non-constant format strings are passed to fmt.Fprintf in user-facing output paths.
Security signals we found
Non-constant format string passed to fmt.Fprintf in help text generation
Incorrect use of t.Fatalf inside a goroutine in test code
Evidence from the diff
The patch addresses two go vet errors. In btcjson/help.go, fmt.Fprintf(w, text) is replaced with fmt.Fprint(w, text) because text is a non-constant string that may contain ‘%’ characters, which could cause formatting errors or unexpected output. In btcec/schnorr/musig2/musig2_test.go, t.Fatalf inside a goroutine is replaced with t.Errorf + return because testing.T.Fatalf only terminates the calling goroutine, not the test process, so subsequent code in the goroutine could execute with invalid state. Both changes are correctness/test-hygiene fixes rather than security patches.
Changed components
btcjson/help.gobtcec/schnorr/musig2/musig2_test.goInspect captured patch +5 / −3
diff --git a/btcec/schnorr/musig2/musig2_test.go b/btcec/schnorr/musig2/musig2_test.go
index ebbe055..f441541 100644
--- a/btcec/schnorr/musig2/musig2_test.go
+++ b/btcec/schnorr/musig2/musig2_test.go
@@ -151,11 +151,13 @@ func testMultiPartySign(t *testing.T, taprootTweak []byte,
nonce := otherCtx.PublicNonce()
haveAll, err := signer.RegisterPubNonce(nonce)
if err != nil {
- t.Fatalf("unable to add public nonce")
+ t.Errorf("unable to add public nonce")
+ return
}
if j == len(signers)-1 && !haveAll {
- t.Fatalf("all public nonces should have been detected")
+ t.Errorf("all public nonces should have been detected")
+ return
}
}
}(i, signCtx)
diff --git a/btcjson/help.go b/btcjson/help.go
index 2cc55b8..bad1044 100644
--- a/btcjson/help.go
+++ b/btcjson/help.go
@@ -269,7 +269,7 @@ func resultTypeHelp(xT descLookupFunc, rt reflect.Type, fieldDescKey string) str
w.Init(&formatted, 0, 4, 1, ' ', 0)
for i, text := range results {
if i == len(results)-1 {
- fmt.Fprintf(w, text)
+ fmt.Fprint(w, text)
} else {
fmt.Fprintln(w, text)
}
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.